Search code examples
amazon-web-servicesaws-lambdaamazon-aurora

Aurora call to a lambda function times out everytime


I'm trying to call a Lambda function from within my Aurora MySql instance. Everything seems to be ok with permissions and roles but every time I call lambda_sync or lambda_async the query times out.

I'm really just trying to do a simple ping to test integration and then start working, I get no errors, just the 504 timeout.

SELECT lambda_async('arn:aws:lambda:eu-west-1:436359:function:ping_api','{"operation": "ping"}');

Calling the same function using Postman is not an issue.

My RDS Cluster and Lambda are in the same VPC and Security Groups and I have added the role ARN to the "default_lambda" param on RDS


Solution

  • Lambda being in the same VPC is irrelevant, as Lambda functions don't sit there idle listening on a port for an inbound connection. Any call to invoke a Lambda function is going to be a call to the public AWS API, to request that AWS create a new invocation of the specified Lambda function. Being in the same VPC would only be needed once your Lambda function tried to open a connection back into the database server.

    Placing separate resources like Aurora and Lambda in the same security group does not automatically allow communication between those resources. Placing different things like Aurora and Lambda in the same security group is actually a bad practice and should be avoided. That's probably not the reason you are encountering an error here, but I wanted to clarify that doing this probably didn't accomplish what you wanted it to.

    I recommend you follow the official documentation on the feature you are trying to use. Specifically, one of the following needs to be true:

    • Your Aurora database is public (publicly accessible enabled on the Aurora cluster, and deployed to public subnets with a route to an Internet Gateway).
    • Your Aurora is not publicly accessible, and is in private subnets with a route to a NAT Gateway.
    • Your Aurora is not publicly accessible, and is in private subnets with an attached AWS Lambda VPC endpoint (and the VPC endpoint has a security group that allows all traffic on port 443).